Evidence boundary: The sources establish an operational Google SecOps transformation from a legacy cyber platform, but do not identify the predecessor vendor or exact production cutover date.
What was reported
PwC describes a greenfield transformation delivered with Google Cloud and Lloyds, while a Google Cloud Security Podcast episode provides earlier direct testimony from Lloyds security engineering leadership.
Verified facts
- Google Security Operations is the destination platform.
- PwC supported the nine-month cyber defence-centre transformation.
- The prior environment is described as a legacy cyber platform with fragmented tools and processes.
- The reported daily alert volume fell from roughly 300 to as few as 10, with about 80% handled through automation.
What is not established
- The predecessor SIEM or security-platform vendor is not named.
- The exact implementation start and production go-live dates are not public.
- The reported outcome measures are customer- and partner-reported rather than independently audited.
PlatformTrace analysis
This is a completed, operational security-platform transformation. PlatformTrace does not infer Splunk, QRadar, ArcSight or another predecessor product from the generic legacy-platform wording.
Sources
- PwC and Lloyds account of the Google SecOps transformation, July 2026.
- Google Cloud Security Podcast with Lloyds security leadership, 28 July 2025.
Corrections and updates
No correction is currently open. Material changes or contradictions will be dated rather than silently overwritten.